Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
745398483bde0910d2ca6d3cdeb20c8799d6c804fcde4837397bf5ed791d7caf.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
745398483bde0910d2ca6d3cdeb20c8799d6c804fcde4837397bf5ed791d7caf.dll
Resource
win10v2004-20230703-en
Target
745398483bde0910d2ca6d3cdeb20c8799d6c804fcde4837397bf5ed791d7caf
Size
1.1MB
MD5
c2cf3f84487b7aec7ece7cdb887e7d13
SHA1
11d2e25e3cdd67e2b91c6f93d71eea07f0d1b5c0
SHA256
745398483bde0910d2ca6d3cdeb20c8799d6c804fcde4837397bf5ed791d7caf
SHA512
f78e183a66f51a13ad647e48f7c91359486fde2480cba26dbd006f347857be43431ced219154a4173e4b32f3a473e1514f134e01c76f737c03b45b5311e1a681
SSDEEP
24576:dLl/W2Jad4T1cXBxyNgF06wo4Yc3gxmR+5wKgGntflTm8bFr3h5rEH7pp:1TYF3nc65wKgGtflTmUtyp
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ord933
ord2145
ord3355
ord6411
ord1754
ord1751
ord4345
ord1493
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord5664
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord2139
ord1792
ord1727
ord5650
ord3140
ord4910
ord1791
ord1220
ord4519
ord4518
ord2479
ord2676
ord3868
ord1070
ord1298
ord310
ord324
ord608
ord1542
ord6528
ord2539
ord1137
ord4044
ord797
ord595
ord3953
ord6531
ord316
ord601
ord266
ord265
ord935
ord939
ord2370
ord5770
ord3406
ord6116
ord818
ord300
ord5852
ord2696
ord2327
ord6079
ord3221
ord5853
ord582
ord784
ord1250
ord802
ord322
ord1076
ord1145
ord406
ord665
ord2490
ord6013
ord2478
ord5939
ord6164
ord6529
ord6022
ord321
ord1271
ord1273
ord5553
ord3071
ord690
ord441
ord1211
ord4442
ord2326
ord4490
ord452
ord1254
ord3187
ord938
ord1603
ord6659
ord5979
ord6686
ord4405
ord1607
ord285
ord3220
ord1599
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord6035
ord4179
ord1048
ord5548
ord6741
ord5830
ord4213
ord2087
ord3217
ord5674
ord5676
ord4347
ord4996
ord5680
ord5663
ord6018
ord2771
ord2983
ord3112
ord4728
ord2966
ord3115
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4905
ord4681
ord3670
ord3500
ord6813
ord1064
ord4309
ord4351
ord2447
ord4211
ord794
ord589
ord4043
ord2537
ord2702
ord5851
ord811
ord296
ord280
ord1855
ord600
ord2694
ord813
ord1152
ord391
ord1233
ord1180
ord305
ord1608
ord946
ord942
ord1088
ord4494
ord6359
ord6687
ord821
ord286
ord799
ord2084
ord1552
ord1261
ord320
ord5535
ord1264
ord1239
ord2695
ord814
ord6660
ord1034
ord663
ord404
ord1241
ord1274
ord605
ord801
memmove_s
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
wcsrchr
_wcsicmp
??1exception@std@@UAE@XZ
_time64
wcsftime
_localtime64_s
?what@exception@std@@UBEPBDXZ
_purecall
wcscpy_s
_beginthreadex
printf
free
_recalloc
calloc
_wfopen_s
fwprintf_s
fflush
fclose
_vsnwprintf_s
malloc
wcsncpy_s
wprintf
_wtoi
fprintf
__iob_func
_wcstoi64
strtol
_strtoi64
memcpy_s
_gmtime64
wcsstr
srand
rand
strncmp
isdigit
realloc
memmove
wcschr
_wcsnicmp
_wcsdup
strstr
wcsncmp
sprintf_s
strpbrk
__CxxFrameHandler3
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_CxxThrowException
__clean_type_info_names_internal
??0exception@std@@QAE@ABQBD@Z
wcstol
_stricmp
memset
memcpy
_except_handler4_common
FindNextFileW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
InterlockedExchange
WaitForSingleObject
GetPrivateProfileStringW
MultiByteToWideChar
LoadLibraryW
FreeLibrary
InterlockedExchangeAdd
GetTempFileNameW
lstrlenA
lstrlenW
WideCharToMultiByte
CreatePipe
CreateProcessW
ResumeThread
ReadFile
TerminateProcess
GetExitCodeProcess
OpenProcess
GetTickCount
CreateFileW
DeviceIoControl
GetDriveTypeW
LocalAlloc
InitializeCriticalSection
QueryPerformanceCounter
GetCurrentThreadId
QueryPerformanceFrequency
GetLogicalDrives
GetDiskFreeSpaceExW
Sleep
WaitForMultipleObjects
LoadLibraryA
MoveFileExW
FileTimeToSystemTime
SystemTimeToFileTime
MoveFileW
GetFileAttributesW
GetFileTime
SetFileAttributesW
SetFileTime
GetFileType
SetFilePointer
GetCurrentDirectoryW
DosDateTimeToFileTime
WriteFile
GetFileInformationByHandle
GetFileSize
ExpandEnvironmentStringsW
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
CreateMutexW
SetEndOfFile
HeapAlloc
HeapFree
InterlockedCompareExchange
UnlockFile
LockFile
OutputDebugStringW
UnlockFileEx
GetProcessHeap
FormatMessageA
HeapDestroy
DeleteCriticalSection
GetLastError
GetSystemTimeAsFileTime
DeleteFileW
LocalFree
FormatMessageW
GetModuleFileNameW
GetLongPathNameW
GetCurrentProcess
GetModuleHandleW
FindClose
CreateThread
FindFirstFileW
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
DuplicateHandle
GetLocalTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetVolumeInformationW
QueryDosDeviceW
Process32NextW
Process32FirstW
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
GetVersion
DeleteFileA
AreFileApisANSI
GetSystemTime
GetTempPathA
GetCurrentProcessId
GetVersionExA
OutputDebugStringA
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingA
GetDiskFreeSpaceW
LockFileEx
HeapSize
GetTempPathW
FlushFileBuffers
HeapValidate
HeapCreate
GetFileAttributesA
PeekMessageW
DispatchMessageW
wsprintfW
DefWindowProcW
LoadIconW
LoadCursorW
EnableWindow
MsgWaitForMultipleObjects
GetDesktopWindow
TranslateMessage
RegCloseKey
RegEnumKeyW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptGetHashParam
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegOpenKeyW
RegQueryInfoKeyW
ord165
SHGetSpecialFolderPathW
ShellExecuteW
SHFileOperationW
CommandLineToArgvW
SHGetValueW
StrFormatByteSizeW
PathFindExtensionW
StrCmpLogicalW
PathFileExistsW
PathUnExpandEnvStringsW
PathRemoveFileSpecW
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
SysAllocString
SysStringLen
VariantClear
SysAllocStringLen
VariantInit
SysFreeString
URLDownloadToFileW
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?uncaught_exception@std@@YA_NXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
_SetBlacklistFile@12
_SetFilterRegKey@16
_SetProcessProtectReg@12
_SetProcessProtectFile@8
_UpdateFileLastOpenMask@0
_SetFilterExcludePID@12
_SetProcessProtectPID@12
_UnregisterMHFilterCallback@8
_RegisterMHFilterCallback@12
ord5
ord4
ord3
ord2
ord1
_QueryRegPath@16
GetDLFileInfo
GAGetThreadStackModule
GAUninit
GAInit
DeleteUrlCacheEntryW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
GetProcessImageFileNameW
WinVerifyTrust
CertFreeCertificateContext
CryptMsgClose
CertCloseStore
CryptQueryObject
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
uncompress
CloseShortcuts
GetShortcutsTargetPath
CreateShortcuts
GetModuleUpdateInfo
SfcIsFileProtected
AVAddAnalysisFile
AVAddAnalysisFiles
AVAddExcludePath
AVAddScanLocation
AVAddScanObjectLocation
AVAddToList
AVAddToListItem
AVClearAnalysisHistoryList
AVClearQuarantineFile
AVCloudSetOption
AVCreateInstance
AVCreateScanObject
AVDeleteExcludePath
AVDeleteLog
AVDeleteMultiToList
AVDeleteQuarantineFile
AVDeleteToList
AVDestroyInstance
AVEnableEngine
AVEnumAnalysisHistoryList
AVEnumEngine
AVEnumLogList
AVEnumLogRecord
AVEnumQuarantine
AVEnumToList
AVEnumToListItem
AVGetAnalysisFileStatus
AVGetDataDetailInfo
AVGetDataInfo
AVGetDataProperty
AVGetEngineDataVersion
AVGetEngineVersion
AVGetExcludePaths
AVGetScanEngines
AVGetScanTime
AVGetToList
AVGetValidInstallerPath
AVInitialize
AVInstall
AVInstallEngine
AVIsUpdateEngine
AVProtectSetCallback
AVProtectSetOption
AVProtectStart
AVProtectStop
AVQuarantineFile
AVReleaseExcludePaths
AVRepair
AVRestoreQuarantineFile
AVSaveLog
AVScan
AVScanAddToList
AVSetCallBack
AVSetDataProperty
AVSetObjectOption
AVSetOption
AVStop
AVStopUpdate
AVSuspend
AVUninitialize
AVUninstall
AVUninstallEngine
AVUpdate
AVUpdateDate
AVUpdateEngine
AVWriteLog
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ